{
  "schema": "https://agent-atoms.com/schemas/atom-v1.json",
  "type": "capability-declaration",
  "id": "db-read-only",
  "version": "1.0.0",
  "name": "DB read-only",
  "description": "SELECT only against a named DSN. No mutations.",
  "capability": {
    "grants": ["network"],
    "elevation": "declared",
    "audit": false
  }
}